Subject: [Txauth] Barry Leiba's No Objection on charter-ietf-gnap-00-01: (with COMMENT)

From: Barry Leiba via Datatracker <[email-masked]>
Date: Wed, 24 Jun 2020 11:11:21 -0700

Barry Leiba has entered the following ballot position for
charter-ietf-gnap-00-01: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-gnap/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

> (in contrast
> with OAuth 2.0 which is initiated by the client redirecting the user’s
> browser)

Editorial nit: This needs a comma after “OAuth 2.0”.

> The client and Authorization Server (AS) will involve a user to make
> an authorization decision as necessary through interaction mechanisms
> indicated by the protocol.

This sentence seems very clumsy and unclear.  The primary thing that bothers me
is “mechanisms indicated by the protocol”: can we rephrase that to make it
clearThe primary thing that bothers me is “mechanisms indicated by the
protocol”: can we rephrase that to make it clearer what we’re talking about,
perhaps by splitting the sentence, explaining what this means first, and then
putting the rest of the sentence after it?  Maybe something like this:

NEW
The protocol will include interaction mechanisms that <some brief explanation>.
 The client and Authorization Server (AS) will use those mechanisms to involve
a user, as necessary, to make authorization decisions. END

> - Support for directed, audience-restricted access tokens

What does “audience-restricted” mean?  Maybe this would be better phrased as,
“Support for directed access tokens that restrict <explanation>” ?

> - Optimized inclusion of additional information through the
> delegation process (including identifiers and identity assertions)

Editorial nit: the parenthetical is misplaced:

NEW
- Optimized inclusion of additional information (including
identifiers and identity assertions) through the delegation process
END

> The group is chartered to develop mechanisms for conveying identity
information > within the protocol including identifiers […] and assertions >
[…] > The group is > not chartered to develop new formats for identifiers or
assertions

It would be good to add “existing” after “including”, for emphasis.

---

From: Roman Danyliw <[email-masked]>
Date: Thu, 25 Jun 2020 13:36:26 +0000

Hi Barry,

A few quick responses/edits before the telechat.

> -----Original Message-----
> From: iesg <[email-masked]> On Behalf Of Barry Leiba via Datatracker
> Sent: Wednesday, June 24, 2020 2:11 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked]
> Subject: Barry Leiba's No Objection on charter-ietf-gnap-00-01: (with
> COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> 

Fixed.

> This sentence seems very clumsy and unclear.  The primary thing that bothers
> me is “mechanisms indicated by the protocol”: can we rephrase that to make it

Todo.

> What does “audience-restricted” mean?  Maybe this would be better phrased
> as, “Support for directed access tokens that restrict <explanation>” ?

I'd prefer we not change this text too much.  "Audience restricted" is a term of art in this space.  See Section 4.8.1.3 of draft-ietf-oauth-security-topics, draft-ietf-oauth-resource-indicators and draft-ietf-oauth-rar.

> > - Optimized inclusion of additional information through the delegation
> > process (including identifiers and identity assertions)
> 
> - Optimized inclusion of additional information (including identifiers and
> identity assertions) through the delegation process END

Fixed.

> information > within the protocol including identifiers […] and assertions > […]
> > The group is > not chartered to develop new formats for identifiers or
> assertions
> 

Fixed.

Regards,
Roman

---

From: Justin Richer <[email-masked]>
Date: Thu, 25 Jun 2020 15:06:52 -0400

Hi Barry, thanks for the comments; Some thoughts on the “TODO” below.

>> a user, as necessary, to make authorization decisions. END

The idea here is that the interaction methods are part of the negotiation between the client and AS. So we could say something like this that should address what you’re after:

The protocol will include a means of specifying how the user can potentially be involved in an interactive fashion during the delegation process. The client and Authorization Server (AS) will use these interaction mechanisms to involve the user, as necessary, to make authorization decisions.

The wording still feels a little shaky to me, but is this going in the right direction?

Thanks,
 — Justin

---

From: Barry Leiba <[email-masked]>
Date: Thu, 25 Jun 2020 15:09:26 -0400

Thanks, Justin... yes, the text you suggest seems much clearer to me,
and I'd like to see that in the charter.

Barry

---

From: Roman Danyliw <[email-masked]>
Date: Thu, 25 Jun 2020 19:29:24 +0000

Hi Justin/Barry: Thanks. I've updated the charter text with this edit.  

Barry: I believe this addresses all of your feedback.

Regards,
Roman

> From: iesg <[email-masked]> On Behalf Of Barry Leiba
> Sent: Thursday, June 25, 2020 3:09 PM
> To: Justin Richer <[email-masked]>
> Cc: Roman Danyliw <[email-masked]>; [email-masked]; The IESG
> <[email-masked]>; [email-masked]
> Subject: Re: [Txauth] Barry Leiba's No Objection on charter-ietf-gnap-00-01:
> (with COMMENT)
> 
> Thanks, Justin... yes, the text you suggest seems much clearer to me, and I'd like
> to see that in the charter.
> 
> Barry
> 
> > This sentence seems very clumsy and unclear.  The primary thing that
> > bothers me is “mechanisms indicated by the protocol”: can we rephrase
> > that to make it clearThe primary thing that bothers me is “mechanisms
> > indicated by the
> > protocol”: can we rephrase that to make it clearer what we’re talking
> > about, perhaps by splitting the sentence, explaining what this means
> > first, and then putting the rest of the sentence after it?  Maybe something
> like this:
> >
> > NEW
> > The client and Authorization Server (AS) will use those mechanisms to
> > involve a user, as necessary, to make authorization decisions. END
> >
> >
> > Todo.
> >
> >
> > The idea here is that the interaction methods are part of the negotiation
> between the client and AS. So we could say something like this that should
> address what you’re after:
> >
> > The protocol will include a means of specifying how the user can potentially
> be involved in an interactive fashion during the delegation process. The client
> and Authorization Server (AS) will use these interaction mechanisms to involve
> the user, as necessary, to make authorization decisions.
> >
> >

---

From: Barry Leiba <[email-masked]>
Date: Fri, 26 Jun 2020 11:57:02 -0400

> Barry: I believe this addresses all of your feedback.

D'accord.

b